McAfee UTILITIES 4.0 Podręcznik Użytkownika Pobierz pdf (Strona 25)

Host intrusion prevention signatures

Host IPS protection resides on individual systems such as servers, workstations or laptop. The

Host Intrusion Prevention client inspects traffic flowing into or out of a system and examines

the behavior of the applications and operating system for attacks. When an attack is detected,

the client can block it at the network segment connection, or can issue commands to stop the

behavior initiated by the attack. For example, buffer overflow is prevented by blocking malicious

programs inserted into the address space exploited by an attack. Installation of back door

programs with applications like Internet Explorer is blocked by intercepting and denying the

application’s “write file” command.

Benefits of host IPS

• Protects against an attack and the results of an attack, such as preventing a program from

writing a file.

• Protects laptops when they are outside the protected network.

• Protects against local attacks introduced by CDs or USB devices. These attacks often focus

on escalating the user’s privileges to “root” or “administrator” to compromise other systems

in the network.

• Provides a last line of defense against attacks that have evaded other security tools.

• Prevents internal attack or misuse of devices located on the same network segment.

• Protects against attacks where the encrypted data stream terminates at the system being

protected by examining the decrypted data and behavior.

• Independent of network architecture; protects systems on obsolete or unusual network

architectures such as Token Ring or FDDI.

Network intrusion prevention signatures

Network IPS protection also resides on individual systems. All data that flows between the

protected system and the rest of the network is examined for an attack. When an attack is

identified, the offending data is discarded or blocked from passing through the system.

Benefits of network IPS

• Protects systems located downstream in a network segment.

• Protects servers and the systems that connect to them.

• Protects against network denial-of-service attacks and bandwidth-oriented attacks that deny

or degrade network traffic.

Behavioral rules

Behavioral rules define legitimate activity. Activity not matching the rules is considered suspicious

and triggers a response. For example, a behavioral rule might state that only a web server

process should access HTML files. If any other process attempts to access HTML files, action

is taken. These rules provide protection against zero-day and buffer overflow attacks.

Behavioral rules define a profile of legitimate activity. Activity that does not match the profile

triggers an event. For example, you can set a rule stating that only a web server process should

access web files. If another process attempts to access a web file, this behavioral rule triggers

an event.

Configuring IPS Policies

Overview of IPS policies

25McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0

1 2 ... 20 21 22 23 24 25 26 27 28 29 30 ... 111 112

Komentarze do niniejszej Instrukcji

Brak uwag

McAfee UTILITIES 4.0 Podręcznik Użytkownika Strona 25

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Oprogramowanie McAfee UTILITIES 4.0